# Password hashing in /etc/shadow

Passwords hashed under Unix/Linux systems can use several hashing algorithms.

      ID  | Method
-------------------------------------------------
1   | MD5
2a  | Blowfish (on some Linux distributions)
5   | SHA-256 (since glibc 2.7)
6   | SHA-512 (since glibc 2.7)


I'm interested in how UNIX uses blowfish to encrypt the password. Is it bcrypt like (and in fact hashing and not encrypting) where the key is derived from the password, expanded and then used to encrypt the password itself several times, finally yielding a hash?

-

## 1 Answer

This "Blowfish" is actually bcrypt itself. Bcrypt was defined by reusing elements of the Blowfish block cipher, but modified. In particular, the key schedule part of the algorithm is expanded into a huge (and configurable) number of rounds.

The password (combined with the salt) is used as key for this modified Blowfish. Once the key schedule has been completed, the modified Blowfish is used to encrypt three blocks, normally the ASCII encoding of the constant string "OrpheanBeholderScryDoubt" (Blowfish, and the modified variant used in bcrypt, work on 64-bit blocks; ECB mode is used; so this yields 192 bits of output).

The man page is misleading, in that it both says that it uses Blowfish (it doesn't, it is a Blowfish variant which is distinct), and that it is encryption (it isn't; it is hashing, as you state).

-
why "OrpheanBeholderScryDoubt" ? Was it suggested in the original bcrypt proposal, or somewhere else? I'm curious abour its origins... –  woliveirajr Jan 16 '14 at 19:01
It is in the original article, and is not explained. They might have described the source orally, during the presentation (I was not there). –  Thomas Pornin Jan 16 '14 at 20:11
:) thanks! Although it seems an innocent string, I think recently problems from privacy make me thing on "I didn't make those numbers" come to my mind more frequently –  woliveirajr Jan 16 '14 at 20:17